BSCP vs OSWE
Two web exams that come up together — how they actually differ, and who each one is for.
Different leagues. BSCP is cheap, fast, and black-box: $99, a four-hour auto-graded exam across two apps, no report, built on PortSwigger's free Web Security Academy. OSWE is an expensive ($1,749) white-box specialist credential — nearly 48 hours of source-code review and custom exploit development, plus a separate 24-hour report. Do BSCP first; reach for OSWE when you want real depth.
- BSCP
- intermediate, $99 exam fee, plus an active Burp Suite Pro licence (separate annual cost)
- OSWE
- expert, From roughly $1,749 with course (WEB-300)
- Harder
- OSWE
| BSCP | OSWE | |
|---|---|---|
| Vendor | PortSwigger | OffSec |
| Level | intermediate | expert |
| Duration | 4-hour exam | 48 hours |
| Format | exploit two vulnerable web apps in three stages each; auto-graded, no report | practical white-box web + report |
| Cost | $99 exam fee, plus an active Burp Suite Pro licence (separate annual cost) | From roughly $1,749 with course (WEB-300) |
What each one is
BSCP is PortSwigger’s black-box web cert. You get two vulnerable applications, three stages each, and four hours to find and exploit your way to the admin-level goal in each one. It is auto-graded, there is no report, and everything you need to prepare lives in the free Web Security Academy. OSWE (OffSec Web Expert, the WEB-300 course) is an expert white-box credential. You are handed application source code and expected to read it, find the flaws, and write working exploits — often full authentication bypasses chained into remote code execution.
The real difference
This is black-box versus white-box, breadth versus depth. BSCP hands you a running app and asks how fast you can break it using techniques you have already practised. OSWE hands you the code and asks whether you can understand an unfamiliar codebase well enough to weaponise a bug nobody has documented for you. One person who took BSCP after OSWE called it easy by comparison — not because the vulnerabilities were easier, but because the exam stays close to the labs. OSWE’s exam stays close to nothing; it expects original exploit development under sustained time pressure.
Cost and time
The gap is enormous. BSCP is $99, includes a Burp Suite Professional licence for the exam, runs four hours with no write-up, and is valid five years. OSWE is a $1,749 bundle covering the course and one exam attempt; the exam itself is 47 hours 45 minutes to score 85 of 100 points, followed by a separate 24-hour window to submit a documented report. BSCP is an afternoon. OSWE is effectively a two-day ordeal plus reporting, and the price reflects that.
Which one to choose
Do BSCP first, almost regardless of your goal — it is cheap, teaches genuinely useful methodology, and proves you can exploit web apps by hand. Move to OSWE when you specifically want source-code review and exploit-development skills: appsec engineering, secure code review, or the OSCE3 track it belongs to. They are not really competitors. BSCP builds the black-box foundation most hunters need; OSWE is the deep, expensive specialisation you tackle once that foundation is solid. Jumping straight to OSWE without comfortable web fundamentals is a common and costly mistake.
What people who sat these say
OSWE involved source code review aka White Box Testing, which I wasn't planning to do.
The cert was pretty easy compared to OSWE, not because the vulnerabilities were easier.
Full detail on each: BSCP · OSWE. For where both sit in a longer plan, see the roadmap.